How to Read Your Water Quality Report: A Plain-English Guide to CCRs

Every spring, a one or two page report shows up in your inbox or your mailbox from your local water utility. It has a name like “Annual Drinking Water Quality Report” or “Consumer Confidence Report.” Most people glance at it, see “no violations,” and recycle it. That report contains the most detailed public information available about exactly what is in the water coming out of your tap, and almost nobody reads it.

HYDR8 builds water filtration for offices, schools, country clubs, and racetracks across the New York and New Jersey metro. To build water.hydr8.us, our free tool that pulls together water quality data for 219 utilities and more than 990 zip codes within roughly 100 miles of New York City, we read more than 200 of these reports cover to cover. So we read these documents for a living. Here is how to read yours.

What is a Consumer Confidence Report (CCR)?

A Consumer Confidence Report, sometimes called an Annual Drinking Water Quality Report, is a document that every Community Water System in the United States is required by federal law to send to its customers each year by July 1. The requirement was created by the 1996 amendments to the Safe Drinking Water Act and applies to roughly 50,000 utilities serving more than 300 million Americans.

If you own a home and pay a water bill, you should be receiving one. If you rent or live in an apartment building, the report is often delivered to the building owner or property manager rather than to individual tenants, in which case you can usually find it on your utility’s website by searching the utility’s name plus “annual water quality report.” For renters who cannot locate it, the property manager is required to make it available on request.

What’s actually in your CCR?

Every CCR follows the same basic structure required by EPA, even though the layout varies by utility. There are five things to look for:

• Source water section. Where your water actually comes from. Reservoir, river, groundwater wells, or some combination. This matters because surface water and groundwater face very different contamination risks.
• Detection table. The substantive part of the report. Lists every regulated contaminant the utility tested for, the highest level detected during the year, and the legal limit. (More on how to read this below.)
• Violations or public notifications. If your utility exceeded a federal or state limit during the year, it must be disclosed here. Most CCRs read “no violations.” When they don’t, pay attention.
• Special advisories. Lead service line inventory status, infant feeding warnings, immunocompromised cautions, boil water history, source water assessment ratings.
• Educational language. Required boilerplate from EPA explaining what contaminants are, who to contact, and what the limits mean. Skim this; it is the same on every report.

How to read the detection table

The detection table is where most readers get lost. CCRs assume you already know what MCL, MCLG, AL, and ND mean. You do not need to be an engineer to read it. Four definitions unlock the entire table:

• MCL (Maximum Contaminant Level). The highest concentration of a contaminant legally allowed in drinking water. The detected level should be at or below this number.
• MCLG (Maximum Contaminant Level Goal). This is the important one. The level at which there is no known or expected health risk. Often lower (sometimes zero) than the MCL, because the MCL also accounts for what is technologically feasible and realistic to achieve for most municipalities.
• AL (Action Level). Used for lead and copper. If more than 10 percent of homes tested exceed the AL, the utility must take corrective action. This is different from an MCL.
• ND (Non-detect). The contaminant was not present at levels above the laboratory’s reporting limit. ND is not the same as zero; it means below the smallest amount the lab can reliably measure.

The single most-missed nuance in any CCR is this: “below MCL” does not mean “not in your water.” A detected level of 8 parts per trillion of PFOA, for example, is technically compliant with the prior New York state limit of 10 ppt, but it is twice the new federal MCL of 4 ppt that takes effect in 2029. The number matters as much as the pass or fail label.

Two more things to notice in the table:

• Range vs average. A reading like “ND-12 ppb” means the contaminant was not detected in some samples but reached 12 parts per billion in others. The average might be 3 ppb, but the spike still happened. Single samples matter, not just yearly averages.
• 90th percentile vs single-sample maximum (lead and copper). If 9 out of 10 homes test below the limit, the utility passes, even if one home tested at 70 ppb. That one home is not safe; it is statistically masked.

Disinfectants and disinfection byproducts: the trade-off your CCR buries

Disinfectants like chlorine and chloramine are intentionally added to your water so pathogens don’t survive the trip from the treatment plant to your tap. They work. EPA caps how much residual disinfectant can remain in your water, called the Maximum Residual Disinfectant Level (MRDL). For free chlorine and chloramine, that limit is 4 milligrams per liter. Almost no public water system runs close to that ceiling, so the line on the CCR will usually read “within MRDL.”

That is good news for pathogens. It is not the full story for taste, smell, or the byproducts that get created downstream.

Residual disinfectant (chlorine or chloramine)

Look for two specific things in this row of your CCR:

1. The range. Utilities report a minimum and maximum residual measured across the distribution system. If the minimum is near or below 0.2 mg/L, residual disinfectant has been consumed by the time water reaches the far end. In long building plumbing (highrises, hospitals, hotels), this can allow microbial regrowth inside the building’s own pipes. The utility is in compliance, but the building owner may want to investigate.
2. Which disinfectant the utility uses. Free chlorine and chloramine require different filtration approaches. Standard activated carbon (the kind in most pitcher filters) handles free chlorine fine, but is not certified for chloramine removal. Cities that use chloramine, like New York City, require catalytic activated carbon or extended contact time to bring the residual down at the tap.

Disinfection byproducts (TTHMs and HAA5)

When chlorine reacts with naturally occurring organic matter in source water (leaves, soil, algae), it creates a family of compounds known as disinfection byproducts. The two regulated groups are Total Trihalomethanes (TTHMs) and Haloacetic Acids (HAA5).

Here is where the CCR framing gets tricky. The federal Maximum Contaminant Level (MCL) for TTHMs is 80 parts per billion, and for HAA5 is 60 parts per billion. So a CCR will often show a TTHMs reading of 38 ppb with a “within MCL” check mark, and the reader concludes everything is fine.

That is half the story. EPA also publishes health goals (MCLGs), non-enforceable thresholds set by the agency’s health scientists at the level where there is no expected risk over a lifetime of exposure. For two of the four TTHMs (bromodichloromethane and bromoform), the MCLG is zero. EPA classifies those compounds as probable human carcinogens. The same is true for dichloroacetic acid, one of the five HAA5 constituents.

What that means in practice: if your CCR shows any detection of TTHMs or HAA5, you are above the EPA health goal for at least some constituents. The reading can be both fully legal under the federal MCL and above the health-protective target at the same time.

What to do

Disinfection itself is not optional. Removing the residual is not a fight worth having with your utility. The fight worth having is at the tap.

• Confirm whether your utility uses free chlorine or chloramine before buying any filter.
• For TTHMs and HAA5, look for filters certified under NSF/ANSI Standard 53 for VOC reduction. NSF Standard 42 (the most common pitcher certification) covers chlorine taste and odor only, not byproducts.
• If your building has long internal plumbing runs and the CCR distribution-residual minimum is below 0.2 mg/L, ask your facilities team about flushing protocols and point-of-use filtration in break rooms and pantries.
• If you operate home dialysis equipment or maintain aquatic life, consult your equipment manufacturer or healthcare provider about disinfectant residuals.

You can check what your specific utility’s most recent CCR reports for chlorine, TTHMs, and HAA5 by entering your zip code at water.hydr8.us. The report flags distribution-floor risk, chloramine cities, and any byproduct readings against both the federal MCL and the health goal.

What your CCR doesn’t tell you

This is where transparency stops. CCRs describe water leaving the utility’s distribution system. They do not cover everything between that point and your glass.

• Premise plumbing. If your building has lead solder, brass fixtures, or galvanized service lines, lead can enter the water inside your building, not from the utility. The CCR cannot see this. The Newark lead crisis of 2018 to 2021 is the textbook example: the utility’s water tested fine; the lead came from corroded service lines between the main and the homes. (We covered the longer story in our Newark Water Safety guide for commercial buildings.)
• Your zip code may be served by multiple utilities. A single zip can include addresses on different water systems. The CCR you receive is for one system. Your neighbor a block away might be on a different one with a different report.
• The report covers last year. Issues that emerged this year, like a new monitoring violation or an emerging contaminant detection, will appear in next year’s CCR, not this one.
• Premises further down the supply chain. Office buildings, schools, and apartment complexes have their own internal plumbing and storage tanks, and water sits in those systems before reaching you. CCR data describes water at the tap of a single-family home in the service area, not at the tap of a 30th-floor office.

Where to find your CCR (and what’s behind it)

Three places will get you to your report:

1. Your water utility’s website. Search the utility’s name plus “annual water quality report” or “consumer confidence report.” Most utilities post the current and previous years.
2. Your state Department of Health or Environmental Protection portal. New York’s Department of Health and New Jersey’s DEP both maintain public CCR repositories.
3. EPA SDWIS. The Safe Drinking Water Information System is the federal database that backs every CCR. SDWIS contains every regulated public water system in the country and ten years of violations history. Search at enviro.epa.gov/facts/sdwis/search.html.

If you live in the New York or New Jersey metro area, we built a free tool called water.hydr8.us that aggregates 219 utility reports plus EPA SDWIS data into one zip-code lookup. Type in your zip and see your detected contaminants, recent violations, and the source water for your address, side by side with the federal MCL and the new EPA limits. Coverage is roughly a 100-mile radius from New York City.

If you live further away, the Environmental Working Group’s Tap Water Database is a solid starting point. EWG covers every U.S. utility, though they use some non-EPA reference values, so a result flagged as concerning may still be below federal limits. Read both their reading and your CCR side by side.

When you should look closer

Most CCRs are unremarkable, and that is usually a good sign. Specific patterns deserve a second read.

• Any lead Action Level exceedance, ever. Even when the 90th percentile is compliant, a single sample reading above 15 ppb is a warning that some homes in the system have a problem. The Village of Garden City’s December 2024 sampling found 90th percentile lead at 20.04 ppb, with 11 of 70 homes tested above the AL and one home at 71.9 ppb. The village added orthophosphate corrosion control in 2022 and is resampling in 2025, but a Garden City address would still want to flush the tap and consider point-of-use filtration in the meantime.
• PFOA or PFOS detected above 4 parts per trillion. The 2024 federal MCL takes effect in 2029. Utilities reading above 4 today have five years to install treatment. Homes within their service area are above the future limit right now. Recent examples in our coverage area include Westbury, NY at 10.4 ppt PFOA (2.6 times the federal MCL), Franklin Square, NY at 6.8 ppt PFOS, Glens Falls, NY at 4.7 ppt PFOA, and Manchester, CT at 13.5 ppt PFOS (3.4 times the federal MCL).
• 1,4-dioxane near or above 1 ppb. This is a New York State limit and an emerging concern across the Northeast. Long Island and the Bethpage area are the well-known examples; we covered the regional story in our piece on microplastics and emerging contaminants in NYC tap water.
• Trihalomethanes (TTHM) or HAA5 near 80 or 60 ppb. These are disinfection byproducts that form when chlorine reacts with organic material in the source water. A reading near the limit means seasonal spikes are likely going over it. The Town of Newburgh Consolidated Water District recorded an individual TTHM peak of 98 ppb between October and December 2024 (above the 80 ppb federal MCL) during the Delaware Aqueduct shutdown, illustrating how seasonal source-water shifts can push a system over the limit even when its annual average looks compliant.
• Active monitoring violations or public notifications in the report. These are not aesthetic issues; they are formal regulatory events. If your utility notes one, read it carefully.
• “High susceptibility” rating in the source water assessment. Most CCRs include a state-issued assessment of how vulnerable the source water is to contamination. “High” or “very high” ratings are worth knowing.

Bottom line

Your CCR is the floor of awareness, not the ceiling. The report tells you what your utility found in the water leaving its plant, sampled at single-family residential taps, with a one-year lag. Everything past that point, including the building you live or work in, is invisible to the report.

That gap is why HYDR8 exists. We design and operate water filtration for the buildings the CCR cannot see. If your office, school, or facility is in the New York or New Jersey metro and you want to know what is happening between the utility’s report and your dispenser, look up your address at water.hydr8.us or get in touch.

Sources

1. U.S. Environmental Protection Agency. Consumer Confidence Reports (CCR) Rule. https://www.epa.gov/ccr
2. U.S. Environmental Protection Agency. SDWIS Federal Reporting Services. https://www.epa.gov/ground-water-and-drinking-water/safe-drinking-water-information-system-sdwis-federal-reporting
3. Centers for Disease Control and Prevention. How to Read Drinking Water Quality Reports. https://www.cdc.gov/drinking-water/about/how-to-read-drinking-water-quality-reports.html
4. Village of Garden City Water Department. 2024 Annual Water Quality Report. https://www.gardencityny.net/DocumentCenter/View/3396/2024-Annual-Water-Quality-Report-PDF
5. U.S. Environmental Protection Agency. Final PFAS National Primary Drinking Water Regulation (April 2024). https://www.epa.gov/sdwa/and-polyfluoroalkyl-substances-pfas